Internet Presents Web of Security Issues

 


 [Note to Editors: For a downloadable copy of this story 

 with color graphics and sidebars, point your browser to 

 www.defenselink.mil or http://websecurity.afis.osd.mil.]

 

 By Paul Stone

 
American Forces Press Service




 WASHINGTON -- In a briefing room deep in the Pentagon 

 earlier this year, Air Force Lt. Col. Buzz Walsh and Maj. 

 Brad Ashley presented a series of briefings to top DoD 

 leaders that raised more than just a few eyebrows.

 

 Selected leaders were shown how it was possible to obtain 

 their individual social security numbers, unlisted home 

 phone numbers, and a host of other personal information 

 about themselves and their families – simply by cruising 

 the Internet.

 

 Walsh and Ashley, members of the Pentagon's Joint Staff, 

 were not playing a joke on the leaders. Nor were they 

 trying to be clever. Rather they were dramatically, and 

 effectively demonstrating the ease of accessing and 

 gathering personal and military data on the information 

 highway – information which, in the wrong hands, could 

 translate into a vulnerability.

 

 "You don't need a Ph.D. to do this," Walsh said about the 

 ability to gather the information. "There's no rocket 

 science in this capability. What's amazing is the ease and 

 speed and the minimal know-how needed. The tools (of the 

 Net) are designed for you to do this."

 

 The concern over personal information on key DoD leaders 

 began with a simple inquiry from one particular flag 

 officer who said he was receiving a large number of 

 unsolicited calls at home. In addition to having the 

 general's unlisted number, the callers knew specifically 

 who he was.

 

 Beginning with that one inquiry, the Joint Staff set out to 

 discover just how easy it is to collect data not only on 

 military personnel, but the military in general. They used 

 personal computers at home, used no privileged information 

 – not even a DoD phone book – and did not use any on-line 

 services that perform investigative searches for a fee.

 

 In less than five minutes on the Net Ashley, starting with 

 only the general's name, was able to extract his complete 

 address, unlisted phone number, and using a map search 

 engine, build a map and driving directions to his house.

 

 Using the same techniques and Internet search engines, they 

 visited various military and military-related Web sites to 

 see how much and the types of data they could gather. What 

 they discovered was too much about too much, and seemingly 

 too little concern about the free flow of information vs. 

 what the public needs to know.

 

 For example, one Web site for a European-based installation 

 provided more than enough information for a potential 

 adversary to learn about its mission and to possibly craft 

 an attack. Indeed, the Web site contained an aerial 

 photograph of the buildings in which the communication 

 capabilities and equipment were housed. By pointing and 

 clicking on any of the buildings, a Web surfer would learn 

 the name of the communications system housed in the 

 building and its purpose.

 

 Taking their quest for easily accessible information one 

 step further, the Joint Staff decided to see how much 

 information could be collected just by typing a military 

 system acronym into an Internet search engine. While not 

 everyone would be familiar with defense-related acronyms, 

 many of them are now batted around the airwaves on talk 

 shows and on the Internet in military-related chat rooms. 

 They soon discovered how easy it was to obtain information 

 on almost any topic, with one Web site hyper-linking them 

 to another on the same topic.

 

 What the Joint Staff was doing when they collected their 

 information is commonly called "data mining" -- surfing the 

 Net to collect bits of information on individuals, specific 

 topics or organizations, and then trying to piece together 

 a complete picture. Individuals do it, organizations do it 

 and some companies do it for profit.

 

 While the information they discovered presented legitimate 

 concerns, it wasn't all negative. The Army's Ft. Belvoir, 

 Va., home page was cited as one example of a Web site which 

 served the needs of both the military and the public. It 

 had the sort of information families or interested members 

 of the public need and should get.

 

 So what does all this mean? Is DoD creating individual and 

 institutional security problems? In the rush to make 

 information available to the internal audience, is too much 

 being made available to the public and those who might want 

 to inflict harm?

 

 The Joint Staff doesn't pretend to have all the answers to 

 these questions, but is encouraging users to think about 

 these issues whenever they put information on the Internet; 

 and they believe that, in some cases, DoD is it's own worst 

 enemy.

 

 Michael J. White, DoD's assistant director for security 

 countermeasures, agrees with the Joint Staff analysis. 

 Moreover, as a security expert, he is concerned DoD does 

 indeed exceed what needs to be on the Internet.

 

 "For fear of not telling our story well enough, we have 

 told too much," he said. "Personally, I think there's too 

 much out there … and you need to stop and ask the question: 

 Does this next paragraph really need to be there, or can I 

 extract enough or abstract enough so that the intent is 

 there without the specificity? And that is hard to do 

 because we are pressed every day. So sometimes expediency 

 gets ahead of pausing for a minute and thinking through the 

 process: Does the data really need to be there? Is it going 

 to hurt me tomorrow morning?

 

 DoD's policy on releasing information to the public, as 

 spelled out by Defense Secretary William Cohen in April 

 1997, requires DoD "to make available timely and accurate 

 information so that the public, Congress and the news media 

 may assess and understand the facts about national security 

 and defense strategy." The same statement requires that 

 "information be withheld only when disclosure would 

 adversely affect national security or threaten the men and 

 women of the Armed Forces."

 

 "On the one hand," Ashley said, "we have fast, cheap and 

 easy global communication and coordination. On the other 

 hand, we find ourselves protecting official information and 

 essential elements of information against point-and-click 

 aggregation. Clearly, this balancing act is a function of 

 risk management. Full openness and full protection are 

 equally bad answers. We have a serious education, training 

 and awareness issue that needs to be addressed."

 

 The Joint Staff repeatedly returns to the issue of "point-

 and-click aggregation" as a problem that is often 

 overlooked when military personnel and organizations place 

 data on the Internet. What they're referring to is the 

 ability to collect bits of information from several 

 different Web sites to compile a more complete picture of 

 an individual, issue or organization with very little 

 effort.

 

 "The biggest mistake people make is they don't understand 

 how easy it is to aggregate information," Walsh said.

 

 The lesson from this is that even though what is posted on 

 the Net is perfectly innocent in and by itself, when 

 combined with other existing information, a larger and more 

 complete picture might be put together that was neither 

 intended nor desired.

 

 A more obvious problem, yet still one not always considered 

 when posting information on the Internet, is that the "www" 

 in Web site addresses stands for "world wide" Web. 

 Information posted may be intended only for an internal 

 audience – perhaps even a very small and very specific 

 group of people. But on the Net, it's available to the 

 world.

 

 This, security experts agree, is an enormous change from 

 the time when foreign intelligence gathering was extremely 

 labor intensive and could only be done effectively on U.S. 

 soil.

 

 "If I'm a bad guy, I can sit back in the security of my 

 homeland and spend years looking for a vulnerability before 

 I decide to take a risk and commit resources," Ashley said. 

 "I'm at absolutely no risk by doing that. I can pick out 

 the most lucrative targets before hand, and may even just 

 bookmark those targets for future use. We won't know 

 something has been compromised until it's too late."

 

 White agrees with the Joint Staff's concern.

 

 "You can sit in Germany and have access to the United 

 States just as easily as you can in Australia or the 

 People's Republic of China or Chile," White said. "It 

 doesn't matter where you are. You can go back and forth and 

 in between and lose your identity on the net 

 instantaneously. Those who seek to use the system feel 

 comfortable they won't be discovered."

 

 In addition to these issues, security experts see another 

 recurring and disturbing problem. In the rush to take 

 advantage of the Net's timeliness and distribution 

 capabilities, military personnel are forgetting about or 

 ignoring the For Official Use Only policies which 

 previously made the information more difficult to obtain. 

 Yet anyone using the Internet doesn't have to venture far 

 into the array of military Web sites to come across one 

 which states: "For Official Use Only."

 

 If the information is For Official Use Only, security 

 experts said Web site developers, managers and commanders 

 must ask themselves whether the information should be there 

 in the first place.

 

 While officials are most concerned about the information 

 being placed on military Web sites, they had similar 

 warnings about individual or family Web sites. The Joint 

 Staff recommends the same precautions should apply at home, 

 especially as personnel move into high-ranking, key 

 leadership positions.

 

 At a time when the flow of information is beyond anyone's 

 capability to either digest it or control its direction, 

 it's not likely the problems brought forward recently by 

 the Joint Staff will be solved any time soon. The first 

 step, security experts said, is awareness the problems 

 exist. Commanders have to understand not just the 

 information capabilities of the World Wide Web, but the 

 information vulnerabilities as well.

 

 The second step, Walsh pointed out, is for commanders to 

 become actively involved in the issue of what's being put 

 on the Internet. Current DoD policies require that local 

 commander, public affairs and security reviews prior to 

 release of data on Web pages. But the flow of information 

 is so great, these reviews may not be occurring and few are 

 looking at the aggregation problem.

 

 "I think it would be very appropriate for a public affairs 

 officer to be the commander's lead representative," Walsh 

 said. "But it's a commander's issue and it should go down 

 command lines. This is certainly an operational security 

 issue. Just like operational security is everybody's 

 business, this ultimately is everyone's responsibility."

 

 White concurred and recommends installations create 

 "security-integrated product teams" which would be tasked 

 to develop and implement guidelines for creating and 

 monitoring Web sites on the installation.

 

 "I think having a group come together before the (Web site 

 development) process begins will remove an awful lot of 

 pain in the long run," White said. "We need to step back 

 one step and think before we begin any effort, because once 

 it's done you can't undo it. That makes it very hard in a 

 digital environment."

 

 Although it's not possible to retrieve what's already on 

 the World Wide Web, nor predict how it will influence 

 future security issues, Walsh, Ashley and White believe 

 it's not too late to make a difference. With a little more 

 forethought and a lot more planning, it will be possible to 

 better protect the next generation of warfighters, both on 

 and off the battlefield, they said.